PT-2026-22400 · Pypi+1 · Pypdf+1

Bugbunny-Research · Published 2026-02-27 · Updated 2026-05-04 · CVE-2026-28351

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.7.4

Description The pypdf library is susceptible to a resource exhaustion issue. An attacker can create a specially crafted PDF file that causes excessive memory usage when processed using the RunLengthDecode filter. This can lead to a denial-of-service condition.

Recommendations Versions prior to 6.7.4 should be upgraded to version 6.7.4 or later. As a temporary workaround, consider applying the changes from PR #3664.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2026-02550

CVE-2026-28351

GHSA-F2V5-7JQ9-H8CG

OPENSUSE-SU-2026:10277-1

Affected Products

Red Os

Pypdf

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28351.json · Exploit
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-f2v5-7jq9-h8cg · Vendor Advisory
• https://github.com/py-pdf/pypdf/pull/3664 · Patch
• https://github.com/py-pdf/pypdf/commit/f309c6003746414dc7b5048c19e6d879ff2dc858 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-28351 · Security Note
• https://ubuntu.com/security/CVE-2026-28351 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-28351 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-28351 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28351 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-28351 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-28351 · Security Note
• https://osv.dev/vulnerability/GHSA-f2v5-7jq9-h8cg · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-28351 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10277-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02550 · Security Note